Claude Code v2.1.214: Permission Check Fixes, the EndConversation Tool, and Narrower dir/** Rule Matching

Claude Code v2.1.214 is a large release with 47 changelog entries, many of them focused on permission checks. Single-segment dir/** rules now match only <cwd>/dir, several Bash and PowerShell permission gaps are closed, and new prompts cover certain docker and file commands. The release also adds the EndConversation tool, a progress heartbeat for long-running tool calls, and new OpenTelemetry attributes, plus fixes for Windows, background sessions, and plugins.

What’s New

Single-Segment `dir/**` Rules Match Only `<cwd>/dir`

Single-segment dir/** allow rules like Edit(src/**) no longer auto-approve writes to nested dir/ directories anywhere in the tree; they now cover only <cwd>/dir. Single-segment dir/** hook if: conditions also match only <cwd>/dir now, so write **/dir/** for any-depth matching. deny/ask permission rules keep their any-depth match.

EndConversation Tool

The new EndConversation tool lets Claude end sessions with highly abusive users or jailbreak attempts, as on claude.ai since 2025. For background, see anthropic.com/research/end-subset-conversations.

New Permission Prompts for `docker` and `file` Commands

docker commands (including the Podman docker shim) that carry daemon-redirect flags (--url, --connection, --identity, and Podman’s remote mode) now ask for permission; previously they ran without a prompt. file commands using -m/--magic-file or -f/--files-from now also require permission instead of being auto-allowed as read-only.

Progress Heartbeat for Long-Running Tool Calls

Long-running tool calls that previously went silent now emit a periodic progress heartbeat.

OpenTelemetry Additions

OpenTelemetry log events now include message.uuid, client_request_id, and tool_source attributes for message-level correlation and tool provenance. The new CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH configures the 60 KB truncation limit on OpenTelemetry content attributes.

Memory and Status Line Additions

Memory file frontmatter now includes an ISO modified timestamp. The subagentStatusLine payload now carries reasoning effort, so custom agent rows can render model and effort.

SessionStart Hooks Report `"fork"`

SessionStart hooks now report source "fork" instead of "resume" when a session begins as a fork.

Fixes and Improvements

Bash permission checks: Checks now fail closed on file-descriptor redirect forms that bash parses differently than the permission analyzer. Commands over 10,000 characters now always prompt instead of running automatically, zsh variable subscripts and modifiers in [[ ]] comparisons are no longer treated as inert text (these commands now prompt for approval), and certain help and man commands that could run unsafe options, command substitutions, or backslash paths are no longer auto-approved.
Other permission fixes: Fixed a permission-check bypass affecting commands run in Windows PowerShell 5.1 sessions. Permission prompts on remote sessions can no longer proceed before the local confirmation dialog.
Hooks: Hooks with exit code 2 now block as documented even when the hook’s stdout JSON fails schema validation.
PowerShell tool (Windows): Commands no longer hang until timeout when a child process waits on standard input. Python scripts run via the tool no longer crash with UnicodeEncodeError on non-ASCII output, and PowerShell 7 error messages no longer contain raw ANSI escape sequences. On Windows PowerShell 5.1, > and >> no longer write UTF-16LE files that other tools couldn’t read as UTF-8.
Background sessions: A displaced background daemon no longer deletes its successor’s control socket on shutdown, which had made the next client kill the healthy replacement daemon. Sessions parked with ← or /background and left idle no longer keep the background daemon and a worker process alive indefinitely, and completed sessions can now be removed via claude rm or the agent view after the background service has gone idle.
Plugins: Plugins enabled via the --settings CLI flag load again (a regression since v2.1.181).
Settings files: Pointing --settings at a device file or multi-GB file no longer causes unbounded memory growth; oversized (>2 MiB) settings files now fail at startup with a clear error.
Linux: The Bash tool no longer kills the Claude session when a pkill -f pattern accidentally matches the CLI’s own process.
Windows proxies: Streaming turns no longer fail with “Socket is closed” behind corporate proxies on Windows.
Scheduled tasks: Scheduled tasks no longer refuse their own configured prompt as untrusted input; the fired prompt is now delivered as the session’s assigned task.
MCP: Transient errors during prompts/resources refresh no longer clear the server’s slash commands and resources.
/ultrareview: In repos with no merge base, /ultrareview now offers to review all tracked files instead of refusing to run.

This release contains 47 changes in total; see the full changelog for every item.

How to Update

Check your installed version: claude --version
Update in place: claude update
Review single-segment dir/** patterns: allow rules like Edit(src/**) and hook if: conditions now match only <cwd>/dir (use **/dir/** in hook conditions for any-depth matching), while deny/ask rules keep their any-depth match.